TI-2026-27833 CVE-2026-36453 · GHSA-96w3-w353-39h8
Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1.
Priority LOW 32
Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1.
Vulnerabilities
5 records
TI-2025-28748 CVE-2025-45242 · GHSA-4v2j-gjc9-p494
Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the…
Priority LOW 34
Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the procFileAdminEditImage method in /file/file.admin.controller.php.
TI-2024-36778 CVE-2024-55089 · GHSA-ghpw-cph8-v3rm
Server-side request forgery in Rhymix
Priority MEDIUM 47
Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because XML documents may contain external entities.
TI-2018-13895 CVE-2018-19601 · GHSA-756g-77hp-9phc
Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.
Priority MEDIUM 42
Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.
TI-2018-13894 CVE-2018-19600 · GHSA-pxmh-q2jw-fgfx
Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.
Priority LOW 23
Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload.